diff --git a/wpa_supplicant/bgscan_learn.c b/wpa_supplicant/bgscan_learn.c
index 6fd81c282..fa0475de4 100644
--- a/wpa_supplicant/bgscan_learn.c
+++ b/wpa_supplicant/bgscan_learn.c
@@ -240,17 +240,14 @@ static int * bgscan_learn_get_probe_freq(struct bgscan_learn_data *data,
 	if (data->supp_freqs == NULL)
 		return freqs;
 
-	idx = data->probe_idx + 1;
-	while (idx != data->probe_idx) {
-		if (data->supp_freqs[idx] == 0) {
-			if (data->probe_idx == 0)
-				break;
-			idx = 0;
-		}
+	idx = data->probe_idx;
+	do {
 		if (!in_array(freqs, data->supp_freqs[idx])) {
 			wpa_printf(MSG_DEBUG, "bgscan learn: Probe new freq "
 				   "%u", data->supp_freqs[idx]);
-			data->probe_idx = idx;
+			data->probe_idx = idx + 1;
+			if (data->supp_freqs[data->probe_idx] == 0)
+				data->probe_idx = 0;
 			n = os_realloc_array(freqs, count + 2, sizeof(int));
 			if (n == NULL)
 				return freqs;
@@ -262,7 +259,9 @@ static int * bgscan_learn_get_probe_freq(struct bgscan_learn_data *data,
 		}
 
 		idx++;
-	}
+		if (data->supp_freqs[idx] == 0)
+			idx = 0;
+	} while (idx != data->probe_idx);
 
 	return freqs;
 }